Https- Bit.ly Crackfire -

[0] pointer to format string (our input) [1] saved %rbp of main [2] saved RIP of main <-- target [3...] other registers / args By printing many %p s we can see where the saved RIP lands. Example payload:

from pwn import *

0x7ffff7a5e000 0x4006f0 0x7ffff7dd18b0 0x4008b0 0x0 0x1 The first pointer ( 0x7ffff7a5e000 ) is a ; the second ( 0x4006f0 ) is _start – an address inside the binary, which is enough to compute the base. https- bit.ly crackfire

[payload] = <addr_of_ret> <addr_of_ret+4> <format string> We must pad the number of bytes printed so that %n writes the correct value.

We’ll use the syntax to reference the n‑th argument directly. 7. Crafting the write payload We want to write the address of win (e.g., 0x5555555552f0 ) into the saved RIP located at stack position 3 (the third argument after the format string). [0] pointer to format string (our input) [1]

| Address | Symbol | Purpose | |---------|--------|---------| | 0x401260 | main | reads user input with scanf("%s", buf) | | 0x4010f0 | check | compares input to a hidden string ( secret ) | | 0x401240 | win | prints flag and exits |

base = 0x4006f0 - 0x4006f0 = 0x0 (actually PIE base = 0x0 when using the absolute address) But more reliably we can leak puts@got (e.g., 0x404018 ) to get the runtime address and compute the base with: We’ll use the syntax to reference the n‑th

$ ./crackfire Welcome to CrackFire! Enter the secret code: > If you type anything other than the hidden code you get: